Policy-based content filtering

ABSTRACT

Methods and systems for processing application-level content of network service protocols are described. According to one embodiment, a firewall maintains multiple configuration schemes, each defining a set of administrator-configurable content filtering process settings. The firewall also maintains a security policy database including multiple firewall security policies. At least one of the firewall security policies includes an associated configuration scheme and an action to take with respect to a particular network session based on a set of source Internet Protocol (IP) addresses, a set of destination IP addresses and/or a network service protocol. Policy-based content filtering of network sessions is performed by: (i) identifying a firewall security policy matching traffic associated with the network session; (ii) identifying content filtering processes to be performed on the traffic based on the configuration scheme associated with the matching firewall security policy; and (iii) applying the identified content filtering processes to the traffic.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.14/093,142 filed on Nov. 29, 2013, which is a continuation of U.S.patent application Ser. No. 13/526,510 filed on Jun. 18, 2012, which isa continuation of U.S. patent application Ser. No. 13/114,292 filed onMay 24, 2011, now U.S. Pat. No. 8,205,251, which is a continuation ofU.S. patent application Ser. No. 11/283,891 filed on Nov. 22, 2005, nowU.S. Pat. No. 7,966,654, each of which is hereby incorporated byreference in its entirety for all purposes.

COPYRIGHT NOTICE

Contained herein is material that is subject to copyright protection.The copyright owner has no objection to the facsimile reproduction ofthe patent disclosure by any person as it appears in the Patent andTrademark Office patent files or records, but otherwise reserves allrights to the copyright whatsoever. Copyright © 2005-2014, Fortinet,Inc.

BACKGROUND

Field

Embodiments of the present invention generally relate to networksecurity. In particular, embodiments of the present invention relate toapplication-level content processing of network service protocols usinga firewall.

Description of the Related Art

Security threats have evolved dramatically over the past 10 years,moving from network-level, connection-oriented attacks toapplication-level, agent-based attacks. Conventional networking devices(firewalls) can deal with network-level packet processing; for example,conventional firewalls can stop packets that do not come from a validsource, and VPN gateways can encrypt packets on the fly, making it safefor them to traverse the Internet.

But today's critical network threats, like viruses and worms, areembedded in the application-level contents of packet streams. Enormousprocessing power is needed to detect and stop these application-layerthreats by extracting the content from multiple packets, reconstructingthe original content, and scanning it for the telltale signs of attacksor for inappropriate content.

A firewall is typically implemented as a hardware/software appliancehaving a number of physical networking interfaces for the incoming andoutgoing network traffic. Firewalls can be software-implemented andinstalled on a stand-alone computer, or they can be full-blown hardwareappliances placed in a network to filter traffic going between multiplecomputers and/or the Internet. Network traffic enters one of theseinterfaces and, after filtering and other appropriate processing, isrouted to a remote host typically attached to a different physicalinterface.

In a firewall, processing of network traffic is performed in accordancewith a set of specific rules, which collectively form a firewall policy.The firewall policy dictates how the firewall should handle networktraffic associated with specific applications such as web browsers,email or telnet. Exemplary rules include filtering of banned words,blocking specific URLs, blocking transmission of specific file types,antivirus scans, blocking of spam, etc. The firewall policy is usuallycreated by the network administrator and is based on the informationsecurity policy of the respective organization.

Conventional firewalls were capable of blocking traffic at the packetlevel but were not intelligent enough to examine the content of thosepackets and to protect against application-layer threats. Modernfirewalls have the ability to examine the content of various networktraffic streams and appropriately react to threats transferred withinthe content of the traffic stream. With the growth of these abilities ofthe firewalls, there has also been a growth in the number of options andsettings that an administrator would need to configure to ensure asecure network.

Many existing firewall systems use global configuration settings, suchas global lists of URLs to block, lists of spam addresses, options toscan for viruses, spam, and others similar parameters. These settingsare applied globally to all policies within the firewall.

This approach, however, does not provide much flexibility to theadministrator. For example it may be desirable to block general staffmembers of an organization from accessing certain websites that don'tnecessarily contain objectionable material but may be a workdistraction. On the other hand, staff managers may not need to berestricted from accessing the same websites. Using global configurationoptions to enable the above firewall configuration presents a difficulttask. In other words, the existing firewall systems, which are oftenconfigured using global settings, tend to apply the same firewallconfiguration scheme to all the network content passing through thefirewall.

Therefore, what is needed is a firewall system providing a flexible andeffective control over configuration parameters applied to filteringand/or processing of various network content. Such a system wouldachieve an optimal content processing performance without compromisingthe security of the protected network.

SUMMARY

Methods and systems are described for processing application-levelcontent of network service protocols. According to one embodiment, afirewall device maintains multiple configuration schemes, each defininga set of administrator-configurable content filtering process settings.The firewall also maintains a security policy database includinginformation defining multiple firewall security policies. Theinformation defining the firewall security policies includes, for atleast one of the firewall security policies, an associated configurationscheme and an action to take with respect to a particular networksession based on a set of source Internet Protocol (IP) addresses, a setof destination IP addresses and/or a network service protocol.Policy-based content filtering of multiple network sessions is performedby the firewall by, for each network session: (i) identifying a firewallsecurity policy from among the firewall security policies that matchestraffic associated with the network session; (ii) identifying contentfiltering processes to be performed on the traffic based on theconfiguration scheme associated with the matching firewall securitypolicy; and (iii) applying the identified content filtering processes tothe traffic.

Other features of embodiments of the present invention will be apparentfrom the accompanying drawings and from the detailed description thatfollows.

BRIEF DESCRIPTION OF THE DRAWINGS

Embodiments of the present invention are illustrated by way of example,and not by way of limitation, in the figures of the accompanyingdrawings and in which like reference numerals refer to similar elementsand in which:

FIG. 1 depicts a conceptual block-diagram of a firewall system inaccordance with an embodiment of the present invention.

FIG. 2 illustrates an operating sequence of a firewall system toestablish a basic network communication session in accordance with anembodiment of the present invention.

FIGS. 3 and 4 illustrate graphical user interface screen shots, whichmay be used to define one or more configuration schemes in accordancewith various embodiments of the present invention.

FIGS. 5 and 6 illustrate graphical user interface screen shots fordisplaying and adjusting parameters of firewall policies in accordancewith various embodiments of the present invention.

FIGS. 7 and 8 illustrate graphical user interface screen shots inaccordance with alternative embodiments of the present invention.

FIG. 9 is a flow diagram illustrating network content processing inaccordance with an embodiment of the present invention.

FIG. 10 is a flow diagram illustrating network content processing inaccordance with an alternative embodiment of the present invention.

FIG. 11 illustrates a computer platform with which embodiments of thepresent invention may be employed.

DETAILED DESCRIPTION

Methods and systems are described for processing application-levelcontent of network service protocols. In the following detaileddescription, reference will be made to the accompanying drawing(s), inwhich identical functional elements are designated with like numerals.The aforementioned accompanying drawings show by way of illustration,and not by way of limitation, specific embodiments and implementationsconsistent with principles of the present invention. Theseimplementations are described in sufficient detail to enable thoseskilled in the art to practice the invention and it is to be understoodthat other implementations may be utilized and that structural changesand/or substitutions of various elements may be made without departingfrom the scope and spirit of present invention. The following detaileddescription is, therefore, not to be construed in a limited sense.Additionally, the various embodiments of the invention as described maybe implemented in the form of a software running on a general purposecomputer, in the form of a specialized hardware, or combination ofsoftware and hardware.

Embodiments of the present invention are directed to methods and systemsthat substantially obviate one or more of the above and other problemsassociated with conventional techniques for configuring firewalls tofilter and/or otherwise process network content.

The inventor recognized that it would have been advantageous to providemethods and systems, which would enable more granular control overfirewall settings. Such configuration flexibility was not permittedunder the conventional techniques.

Firewalls and other filtering gateways have become common securitydevices for improving computer network security. As more features andfunctionality are added to these devices they become quite complex toconfigure. By associating configuration schemes with firewall policies,configuration can be simplified without compromising flexibility.Administrators have more options to filter different traffic streamsbased on their type and sources. They also have increased flexibility tobe able to filter traffic on a per user basis, through authenticationmechanisms tied to various filtering options.

Generally, firewall policies are designed to control the flow of networktraffic through the firewall. A typical firewall policy defines a set ofrules applied to handling of the entire passing network traffic or anyspecific portion thereof. The portion of the network traffic to which apredetermined firewall policy applies may be specified using, forexample, the network address of the source entity, the network addressof the destination entity as well as the networking protocol used in thetransmission. Different firewall policies may be assigned to differenttransmission protocols, which, in turn, implement different networkingservices.

When a specific network connection is initiated, the connection willcommonly have an associated source network address, destination networkaddress and service port identifier. This information is gathered by thefirewall and checked against existing firewall policies. If theconnection information matches a specific firewall policy, the firewallapplies the relevant policy to the connection.

Low-level, network layer firewalls generally may only permit or rejectthe network traffic, typically at the network packet level, and theymake their decisions based on the source and destination addresses andthe associated network ports in individual IP packets. In suchfirewalls, the set of rules associated with the firewall policy maygenerally specify which network traffic is permitted to proceed andwhich is rejected and the firewall policy may be defined in terms ofsource and destination IP addresses together with the associatedcommunication ports. This information is contained in individual IPpackets and is retrieved by the firewall upon packet inspection.

Higher-level, content-filtering application layer firewalls generallyare hosts running proxy servers, which permit no traffic directlybetween networks, and which perform elaborate logging and auditing oftraffic passing through them. Because the proxy applications aresoftware components running on the firewall, they are used to performlogging and access control. In such systems, the firewall policy mayprovide an additional option for handling of the network traffic, whichmay include re-directing specific packets to another routine or program,such as a proxy, which may perform a specified operation upon thepackets or gather the content of the packets for deeper examinationand/or logging. Because of the greater flexibility of the networktraffic processing in the proxy, the configuration of the proxy mayinvolve a substantial number of configuration parameters.

In accordance with an embodiment of the invention, in a firewall systemhaving the ability to redirect the communication stream to the proxyprogram, each firewall policy is provided with an associated collectionof settings. These settings may generally include, but are not limitedto, various types of filters. By having the ability to associate acollection of settings (hereinafter referred to as “configurationscheme”) with individual firewall polices, the administrator of theinventive firewall system has a greater control over how variouscommunication pathways are filtered.

In an exemplary embodiment of the inventive firewall system, aconfiguration scheme is associated with a specific firewall policy bymeans of a scheme identifier, a variable, comprising numericinformation, character information or binary bits, that is stored in adata structure associated with the firewall policy, which is called a“policy structure.” The policy structure may be disposed within thekernel of the firewall computer system. When a new communication sessionmatching a particular firewall policy is initiated, this sessioninherits the scheme identifier value from the corresponding policystructure. The proxy program, to which the communication connection isredirected, then retrieves this identifier value from the communicationconnection structure and uses it to look up the scheme settings from theconfiguration database or, alternatively, from a local cache. Theconfiguration database in the inventive system may be as simple as atext file holding records of information or as complex as a fullyfeatured database system.

FIG. 1 illustrates a topology of a firewall-protected network 100 inaccordance with an embodiment of the present invention. Two networkentities 104 and 105 are connected to opposite sides of a physicaldevice (the firewall) 101, which monitors the network traffic 108, 109passing between them. The firewall 101 may drop or alter some of thistraffic based on a predefined set of rules. Therefore, the content ofthe network traffic 108 may not be identical to the content of thetraffic 109. According to an embodiment of the inventive technique, thetwo network entities 104 and 105 are connected to the firewall 101 by adirect link. In an alternative embodiment, the connection isaccomplished through a routed network (not shown).

As shown in FIG. 1, the firewall 101 is disposed within the networkcommunication channel between the two user systems 104 and 105 andmonitors network packet exchanges between them. As would be appreciatedby those of skill in the art, for some well-known protocols, such asTCP, the transmitted network packets can be inspected for known threatsor questionable content by one or more scanning engines. When a packetthat matches one of the known signatures is detected, the inventivefirewall system may generate a log message or set off an alarm, and thepacket may be dropped. In one embodiment of the inventive system, theentire connection between the two users would be dropped as well.

As would be also appreciated by those of skill in the art, in manycases, the rules or signatures used to detect questionable data cannotbe applied to individual packets.

Stream protocols, such as TCP, will break up data into smaller chunksduring transmission, but the detection heuristics must be applied to theentire data stream rather than the individual packets. Therefore, in theinventive system, the data would be first buffered by the firewall 101in order to extract the data stream, and then the filtering rules wouldbe applied to this stream. In many cases, the packets would beredirected by the networking subsystem 106 of the kernel of the firewall101 to a user space application (proxy) 107 that builds and interpretsthe data buffer.

The firewall system shown in FIG. 1 includes physical network interfaces102 and 103, and the aforesaid networking subsystem 106, which may beimplemented as a part of the kernel of the operating system of thefirewall appliance 101. The networking subsystem 106 routes the packetsbetween the physical interfaces 102 and 103 and transfers the databetween various logical subsystems on the firewall system 101. Severaltypes of stream-based data are intercepted by the networking subsystem106 and buffered by a proxying module 107 for future processing. Itshould be noted that while FIG. 1 shows only physical interfaces, inanother embodiment of the inventive firewall, one or both of theinterfaces 102 and 103 may be logical interfaces.

The networking subsystem 106 may be configured to intercept datatransmissions formatted in accordance with various networking protocolsincluding, without limitation, Server Message Block/Common Internet FileSystem (SMB/CIFS), instant messaging (IM) protocols (e.g., AOL InstantMessenger (AIM), MICROSOFT Network (MSN) messenger, YAHOO! Messenger,SKYPE), and peer-to-peer (P2P) protocols (e.g., FASTTRACK, BEEP,GNUTELLA, AVALANCHE, BITTORRENT). Additionally, Simple Mail TransferProtocol (SMTP), Post Office Protocol 3 (POP3), Internet Message AccessProtocol (IMAP), HyperText Transfer Protocol (HTTP), File TransferProtocol (FTP), telnet, etc. The intercepted data packets are routed tothe proxy module 107 for re-assembly, inspection and other processing.

In one embodiment of the invention, the proxying module 107 isimplemented in the OS kernel. In an alternative embodiment, the proxy107 is implemented in the form of an application executing in the userspace provided by the operating system of the firewall appliance 101.The proxying module 107 assembles the formatted packets intercepted bythe networking subsystem 106 in accordance with the specification of therespective communication protocol to arrive at the transmission content.Depending on the specifics of the used communication protocol, anembodiment of the inventive system may provide for re-ordering of thedata packets prior to, or during the transmission re-assembly.

A configuration database 110 stores various firewall policies,configuration schemes and other parameters used by the firewall system101. The stored parameters are retrieved from the database 110 by theproxy 107. In one embodiment of the inventive system, the proxyingmodule 107 is configured to support one network protocol. In suchimplementation, multiple proxying subsystems may be provided if thesystem is designed to handle multiple protocols. Additionally oralternatively, multiple instances of proxy 107 may be executed tosupport the same network protocol or different network protocols.Moreover, the proxy 107 may be designed to support the entirecommunication language of the respective protocol or any portionthereof. Finally, the proxy 107 may use an external program to retrievevarious configuration settings from the database 110. Likewise, anexternal program may be used to apply various filters to the networktransmission content processed by the proxy 107.

FIG. 2 illustrates an operating sequence of the inventive firewallsystem associated with establishment of a basic network communicationsession. An incoming connection 201 is accepted by the networkingsubsystem 106 of the firewall kernel after a lookup of an applicablefirewall policy. In the shown sequence, the policy indicates that thesession should be redirected (at 202) to the user level proxy 107. Theproxy 107 performs any needed initialization and then queries the kernel(at 203) to retrieve the configuration scheme associated with thesession. Once the scheme identifier has been retrieved (at 204) theproxy queries (at 205) the configuration database (110) to retrieve thesettings for the configuration scheme matching the specified identifier.Once the settings are retrieved (at 206) the proxy 107 can continue withany filtering tasks or other tasks necessary to handle the networkingsession.

In an embodiment of the inventive concept, multiple configurationschemes may be specified by the network administrator using, forexample, a graphical user interface or a command line interface of thefirewall system 101. The settings specified by the administrator, aswell as other appropriate parameters, may be stored in the configurationdatabase 110 for subsequent retrieval. In an exemplary embodiment of theinventive technique, each created configuration scheme is assigned aunique identifier value, which may or may not be displayed to theadministrator. This identifier value is subsequently stored in one ormore data structures associated with the corresponding firewall policyand used to retrieve the appropriate configuration scheme.

The configuration database 110 may be implemented on the same computerplatform as the rest of the firewall 101. This database may beimplemented using any suitable database system, such as general-purposerelational database systems distributed by ORACLE Corporation, IBMCorporation and MICROSOFT Corporation. In an alternative embodiment ofthe invention, a special-purpose embedded database may be utilized. Inyet alternative embodiment, the configuration database may beimplemented using file system facilities of the firewall 101. Finally,the database system 110 may be implemented on separate computer hardwarefrom the rest of the firewall 101.

FIGS. 3 and 4 display exemplary embodiments of a graphical userinterface which may be used by an administrator of the inventivefirewall system in defining one or more configuration schemes.Specifically, the interface 300 shown in FIG. 3 displays a list ofexisting configuration schemes 301-304. Each of the schemes 301-304 maybe assigned a unique name or alias for easy reference. Using theinterface 300, new schemes may be created and the existing schemes maybe modified or deleted.

The interface 400 shown in FIG. 4 displays a detailed view of a specificconfiguration scheme. The displayed exemplary scheme 400 is arrangedinto separate protocol sections (columns 401-406). Each such section mayinclude multiple configuration settings corresponding to the specificprotocol. The protocols shown in FIG. 4 include HTTP, FTP, SMTP, IMAP,POP3, SMB/CIFS. However, the invention is not limited only to the shownprotocols. Any other suitable protocols may be used. Normally, theinventive interface 400 only displays protocols supported by the proxyengine 107 of the firewall 101. However, as the proxy functionality isexpanded to support additional networking protocols, the graphical userinterface 400 may be configured, either manually or automatically, todisplay those additional protocols as well.

As will be appreciated by those of skill in the art, not allconfiguration settings are appropriate for all protocols. Therefore, inthe inventive interface 400, some settings are not available for someprotocols. For example, the e-mail spam block is not available fornon-email protocols. Various parameters of the specific configurationscheme displayed using the interface 400 may be input or adjusted by thenetwork administrator by means of toggle options (checkboxes), namedselections (drop down combo boxes), multi-selections, as well as numberand text based entries. The configuration scheme may include lists ofvarious items, such as lists of banned words or lists of HTTP URLs to beblocked. Such lists may be linked to appropriate graphical primitive(s)within the interface 400, such as items 408-410 shown in FIG. 4. Uponadministrator's selection of the appropriate graphical primitive, thecorresponding list may be displayed and the administrator may beprovided with an ability to add to or otherwise modify its content.

As it would be appreciated by those of skill in the art, the inventiveconcept is by no means limited only to the shown parameters andsettings. Various other settings and parameters may be displayed andappropriately configured by the interfaces 300 and 400. Moreover, theinterface 400 may be configured to automatically display new parametersand configuration options when it detects that the proxy module 107 ofthe firewall 101 has been enhanced to support new protocols as well asnew filtering and other content processing capabilities.

In addition to the capability to create and/or modify firewallconfiguration schemes, an embodiment of the present invention isadditionally provided with a graphical user interface or, alternatively,a command line interface enabling an administrator to specify and managemultiple firewall policies. The policy settings may also be stored inthe configuration database 110. In an embodiment of the invention, atleast a portion of information descriptive of the policy settings isstored in the kernel of the firewall 101.

Exemplary embodiments of the policy-setting graphical user interfaces ofthe inventive firewall system 101 are illustrated in FIGS. 5 and 6.Specifically, exemplary interface 500 shown in FIG. 5 displays a list ofall firewall policies in effect. The shown interface 500 is organized ina tabular form with each of the rows 501, 502 and 503 corresponding tofirewall policies with policy identification numbers 1, 2 and 5,respectively. Parameters in columns 504, 505 and 507 specify sourcenetwork address, destination network address and transmission protocolto which specific listed policy is made applicable. Column 506 specifieswhen the specific policy has effect. Column 508 contains settingsspecifying how the corresponding network traffic should be handled. Theconfiguration scheme for each effective policy is specified in column509. The network administrator is provided with an option to enable ordisable any specific policy and to modify or delete it, see columns 510and 511.

FIG. 6 illustrates graphical user interface 600 for displaying andadjusting various individual parameters of a specific firewall policy.The policy parameters included in the interface 600 generally correspondto the columns of interface 500. Using the interface 600, theadministrator may modify any appropriate policy settings.

As described in details above, any specific firewall policy may beprovided with an associated configuration scheme such that networkingprotocols supported by the policy are filtered or otherwise processed inaccordance with the settings of that configuration scheme. The relevantconfiguration scheme is identified and assigned to a session when thesession is created. At that point, the configuration scheme identifieris written into the policy structure in the kernel so that it can betransferred into new session structures as new sessions connect. If morethan one policy is defined, different policies may use either the sameconfiguration scheme, all different configuration schemes, or anycombination of the above. It is also permissible, in an embodiment ofthe invention, to apply no configuration scheme to a policy. In such acase, the policy becomes a conventional firewall policy with nofiltering capabilities. In another embodiment of the invention, multipleconfiguration schemes may be assigned to a single firewall policy.

In another embodiment of the invention, the policy-based filters areimplemented using user-authenticated groups. Specifically, certainfirewall policies may utilize some form of user authentication. Toenable utilization of such policies, one or more users on the networkmay be grouped together into one or more named groups of users, forexample Accounting Team. It should be noted that certain groups mayconsist of only one user. A specific firewall configuration scheme maybe assigned to a user group or an individual user. As would beappreciated by those of skill in the art, the utilization of usergroup-based firewall policies and associated configuration schemesenables flexible assignment of different levels of use restrictions ofvarious network services to different groups of users.

FIGS. 7 and 8 illustrate an alternative embodiment of the user interfaceof the inventive firewall system. In the interface shown in FIG. 7,multiple configuration schemes are displayed on the same page togetherwith their parameters. Each of the rows 701 and 702 corresponds to aspecific configuration scheme, while each of the columns 703-707displays settings corresponding to one specific networking protocol. Onthe other hand, the interface 800 shown in FIG. 8 may be used to editvarious parameters associated with a specific configuration scheme. Inthe interface 800, shown in that figure, various protocols are groupedtogether in accordance with protocol type, including web protocol 801,mail protocols 802 and file transfer protocol 803. The configurationscheme parameters displayed in FIG. 8 generally correspond to parametersincluded in each of the rows 701 or 702 of FIG. 7.

FIG. 9 illustrates exemplary operating sequence 900 of an embodiment ofthe inventive firewall system 101. Upon the receipt of the incomingconnection, at step 902, the inventive firewall system 101 uses theconnection information to identify the applicable firewall policy, seestep 903. The relevant connection information may include, withoutlimitation, the connection source and destination addresses, as well asconnection service protocol determined in accordance to the connectionport number information. The necessary connection information may beextracted from the network packets intercepted by the networkingsubsystem 106 of the kernel.

At step 904, the system applies packet-layer firewall rules to determinewhether the connection should be allowed. Non-compliant connections arerejected at step 909. The allowed connections are checked against a listof service protocols supported by the proxy 107, see step 905. Contentformatted according to non-supported protocols is sent directly to thedestination at step 908. If the connection protocol is supported by theproxy 107, at step 906, the system checks whether a specificconfiguration scheme is assigned to the connection, and, if so, appliesthe scheme at step 907. At step 910, the system checks whether thetransmission content needs to be modified and modifies the content, ifappropriate, at step 911.

FIG. 10 illustrates an exemplary operating sequence 1000 of analternative embodiment of the inventive firewall system 101. Thesequence 1000 differs from the sequence 900 of FIG. 9 in applyingadditional authentication steps 1005 and 1006 to the networkingconnection. Specifically, upon determination, at step 904, that theconnection satisfies the packet-layer rules, the system authenticatesthe user and rejects the connection if the authentication fails, seesteps 1005 and 1006, respectively. In addition, in the sequence shown inFIG. 10, at step 1007, the inventive system checks for a configurationscheme assigned to the user/usergroup, which, in turn, corresponds tothe firewall policy that applies to the current connection. The foundscheme is then applied at step 907. The remaining steps of the sequence1000 are equivalent to the corresponding steps of the sequence 900 ofFIG. 9.

An example of a hardware platform in accordance with an embodiment ofthe present invention will now be described. FIG. 11 is a block diagramthat illustrates an embodiment of a computer platform 1100 upon which anembodiment of the inventive methodology may be implemented. The system1100 includes a computer/server platform 1101, peripheral devices 1102and network resources 1103.

The computer platform 1101 may include a data bus 1104 or othercommunication mechanism for communicating information across and amongvarious parts of the computer platform 1101, and a processor 1105coupled with bus 1101 for processing information and performing othercomputational and control tasks. Computer platform 1101 also includes avolatile storage 1106, such as a random access memory (RAM) or otherdynamic storage device, coupled to bus 1104 for storing variousinformation as well as instructions to be executed by processor 1105.The volatile storage 1106 also may be used for storing temporaryvariables or other intermediate information during execution ofinstructions by processor 1105. Computer platform 1101 may furtherinclude a read only memory (ROM or EPROM) 1107 or other static storagedevice coupled to bus 1104 for storing static information andinstructions for processor 1105, such as basic input-output system(BIOS), as well as various system configuration parameters. A persistentstorage device 1108, such as a magnetic disk, optical disk, orsolid-state flash memory device is provided and coupled to bus 1101 forstoring information and instructions.

Computer platform 1101 may be coupled via bus 1104 to a display 1109,such as a cathode ray tube (CRT), plasma display, or a liquid crystaldisplay (LCD), for displaying information to a system administrator oruser of the computer platform 1101. An input device 1110, includingalphanumeric and other keys, is coupled to bus 1101 for communicatinginformation and command selections to processor 1105. Another type ofuser input device is cursor control device 1111, such as a mouse, atrackball, or cursor direction keys for communicating directioninformation and command selections to processor 1104 and for controllingcursor movement on display 1109. This input device typically has twodegrees of freedom in two axes, a first axis (e.g., x) and a second axis(e.g., y), that allows the device to specify positions in a plane.

An external storage device 1112 may be connected to the computerplatform 1101 via bus 1104 to provide an extra or removable storagecapacity for the computer platform 1101. In an embodiment of thecomputer system 1100, the external removable storage device 1112 may beused to facilitate exchange of data with other computer systems.

Embodiments of the invention relate to the use of computer system 1100for implementing the techniques described herein. In an embodiment, theinventive content processing systems 300 and 400 may reside on a machinesuch as computer platform 1101. In an embodiment, database 313 may bedeployed on a machine such as computer platform 1101. According to oneembodiment of the invention, the techniques described herein areperformed by computer system 1100 in response to processor 1105executing one or more sequences of one or more instructions contained inthe volatile memory 1106. Such instructions may be read into volatilememory 1106 from another computer-readable medium, such as persistentstorage device 1108. Execution of the sequences of instructionscontained in the volatile memory 1106 causes processor 1105 to performthe process steps described herein. In alternative embodiments,hard-wired circuitry may be used in place of or in combination withsoftware instructions to implement the invention. Thus, embodiments ofthe invention are not limited to any specific combination of hardwarecircuitry and software.

The term “computer-readable medium” as used herein refers to any mediumthat participates in providing instructions to processor 1105 forexecution. The computer-readable medium is just one example of anon-transitory machine-readable medium, which may carry or otherwiseembody instructions for implementing any of the methods and/ortechniques described herein. Such a medium may take many forms,including but not limited to, non-volatile media and volatile media.Non-volatile media includes, for example, optical or magnetic disks,such as storage device 1108. Volatile media includes dynamic memory,such as volatile storage 1106.

Common forms of non-transitory computer-readable media include, forexample, a floppy disk, a flexible disk, hard disk, magnetic tape, orany other magnetic medium, a CD-ROM, any other optical medium,punchcards, papertape, any other physical medium with patterns of holes,a RAM, a PROM, an EPROM, a FLASH-EPROM, a flash drive, a memory card,any other memory chip or cartridge.

Various forms of computer readable media may be involved in carrying oneor more sequences of one or more instructions to processor 1105 forexecution. For example, the instructions may initially be carried on amagnetic disk from a remote computer.

Alternatively, a remote computer can load the instructions into itsdynamic memory and send the instructions over a telephone line using amodem. A modem local to computer system 1100 can receive the data on thetelephone line and use an infrared transmitter to convert the data to aninfrared signal. An infrared detector can receive the data carried inthe infrared signal and appropriate circuitry can place the data on thedata bus 1104. The bus 1104 carries the data to the volatile storage1106, from which processor 1105 retrieves and executes the instructions.The instructions received by the volatile memory 1106 may optionally bestored on persistent storage device 1108 either before or afterexecution by processor 1105. The instructions may also be downloadedinto the computer platform 1101 via Internet using a variety of networkdata communication protocols well known in the art.

The computer platform 1101 also includes a communication interface, suchas network interface card 1113 coupled to the data bus 1104.Communication interface 1113 provides a two-way data communicationcoupling to a network link 1114 that is connected to a local network1115. For example, communication interface 1113 may be an integratedservices digital network (ISDN) card or a modem to provide a datacommunication connection to a corresponding type of telephone line. Asanother example, communication interface 1113 may be a local areanetwork interface card (LAN NIC) to provide a data communicationconnection to a compatible LAN. Wireless links, such as well-known802.11a, 802.11b, 802.11g and Bluetooth may also be used for networkimplementation. In any such implementation, communication interface 1113sends and receives electrical, electromagnetic or optical signals thatcarry digital data streams representing various types of information.

Network link 1113 typically provides data communication through one ormore networks to other network resources. For example, network link 1114may provide a connection through local network 1115 to a host computer1116, or a network storage/server 1117. Additionally or alternatively,the network link 1113 may connect through gateway 1117 to the wide-areaor global network 1118, such as an Internet. Thus, the computer platform1101 can access network resources located anywhere on the Internet 1118,such as a remote network storage/server 1119. On the other hand, thecomputer platform 1101 may also be accessed by clients located anywhereon the local area network 1115 and/or the Internet 1118. The networkclients 1120 and 1121 may themselves be implemented based on thecomputer platform similar to the platform 1101.

Local network 1115 and the Internet 1118 both use electrical,electromagnetic or optical signals that carry digital data streams. Thesignals through the various networks and the signals on network link1114 and through communication interface 1113, which carry the digitaldata to and from computer platform 1101, are exemplary forms of carrierwaves transporting the information.

Computer platform 1101 can send messages and receive data, includingprogram code, through the variety of network(s) including Internet 1118and LAN 1115, network link 1114 and communication interface 1113. In theInternet example, when the system 1101 acts as a network server, itmight transmit a requested code or data for an application programrunning on client(s) 1120 and/or 1121 through Internet 1118, gateway1117, local area network 1115 and communication interface 1113.Similarly, it may receive code from other network resources.

The received code may be executed by processor 1105 as it is received,and/or stored in persistent or volatile storage devices 1108 and 1106,respectively, or other non-volatile storage for later execution. In thismanner, computer system 1101 may obtain application code in the form ofa carrier wave.

It should be noted that embodiments of the present invention are notlimited to any specific firewall system. For example, the inventivepolicy-based content processing system may be used in any of the threefirewall operating modes and specifically NAT, routed and transparent.

Finally, it should be understood that processes and techniques describedherein are not inherently related to any particular apparatus and may beimplemented by any suitable combination of components. Further, varioustypes of general purpose devices may be used in accordance with theteachings described herein. It may also prove advantageous to constructspecialized apparatus to perform the method steps described herein. Thepresent invention has been described in relation to particular examples,which are intended in all respects to be illustrative rather thanrestrictive. Those skilled in the art will appreciate that manydifferent combinations of hardware, software, and firmware will besuitable for practicing the present invention. For example, thedescribed software may be implemented in a wide variety of programmingor scripting languages, such as Assembler, C/C++, perl, shell, PHP,Java, etc.

Moreover, other implementations of various embodiments of the presentinvention will be apparent to those skilled in the art fromconsideration of the specification and practice of the inventiondisclosed herein. Various aspects and/or components of the describedembodiments may be used singly or in any combination in the computerizednetwork content processing system. It is intended that the specificationand examples be considered as exemplary only, with a true scope andspirit of the invention being indicated by the following claims.

What is claimed is:
 1. A computer-implemented method comprising:maintaining, by a firewall device within a user space of the firewalldevice, a plurality of configuration schemes, wherein each of theplurality of configuration schemes comprises a listing of a plurality ofnetwork service protocols, and wherein each of the plurality ofconfiguration schemes defines, for each particular network serviceprotocol in the plurality of network service protocols, a set ofadministrator-configurable application-level content filtering processsettings that indicates one or more particular application-level contentfiltering processes to perform; maintaining, by the firewall devicewithin a kernel of the firewall device, a security policy databaseincluding information defining a plurality of firewall securitypolicies, wherein the information defining the plurality of firewallsecurity policies includes, for each one of the plurality of firewallsecurity policies, information identifying an associated one of theplurality of configuration schemes and an action to take with respect toa particular network session based on one or more of a set of one ormore source Internet Protocol (IP) addresses, a set of one or moredestination IP addresses and a network service protocol; and performing,by the firewall device, policy-based application-level content filteringof a plurality of network sessions by, for each network session of theplurality of network sessions: identifying, by the kernel, a firewallsecurity policy from among the plurality of firewall security policiesthat matches traffic associated with the network session; when theaction to take of the matching firewall security policy indicates thenetwork session is allowable, then: redirecting, by the kernel, thenetwork session to a proxy of a plurality of proxies running within thefirewall device; identifying, by the proxy, a plurality ofapplication-level content filtering processes to be performed on thetraffic as specified by the configuration scheme specified by thematching firewall security policy; and applying, by the proxy, theidentified plurality of application-level content filtering processes tothe traffic.
 2. The method of claim 1, further comprising: processingapplication-level content of a packet stream associated with the networksession by reassembling the application-level content from a pluralityof packets of the packet stream; and scanning the application-levelcontent based on the identified plurality of content filteringprocesses.
 3. The method of claim 2, wherein the network serviceprotocol comprises at least one of a group consisting of HyperTextTransfer Protocol (HTTP), File Transfer Protocol (FTP), Simple MailTransfer Protocol (SMTP), Post Office Protocol 3 (POP3), InternetMessage Access Protocol (IMAP) and Server Message Block/Common InternetFile System (SMB/CIFS).
 4. The method of claim 3, further comprisingreceiving from a network administrator, by the firewall device, via agraphical user interface, selections indicative of the content filteringprocesses to be performed on the traffic associated with the particularnetwork session.
 5. The method of claim 4, wherein content filteringoptions available to the network administrator via the graphical userinterface include at least antivirus scanning, Uniform Resource Locator(URL) blocking and file blocking.
 6. The method of claim 5, wherein thecontent filtering options available to the network administrator via thegraphical user interface further include one or more of banned wordfiltering and spam blocking.
 7. The method of claim 5, wherein the fileblocking comprises blocking transmission of specific file types.
 8. Themethod of claim 1, further comprising receiving from a networkadministrator, by the firewall device, via a graphical user interface,selections indicative of one of the plurality of configuration schemesto be associated with one of the plurality of firewall securitypolicies.
 9. A non-transitory computer-readable storage medium embodyinga set of instructions, which when executed by one or more processors ofa firewall system, cause the one or more processors to perform a methodcomprising: maintaining, by a firewall device within a user space of thefirewall device, a plurality of configuration schemes, wherein each ofthe plurality of configuration schemes comprises a listing of aplurality of network service protocols, and wherein each of theplurality of configuration schemes defines, for each particular networkservice protocol in the plurality of network service protocols, a set ofadministrator-configurable application-level content filtering processsettings that indicates one or more particular application-level contentfiltering processes to perform; maintaining, by the firewall devicewithin a kernel of the firewall device, a security policy databaseincluding information defining a plurality of firewall securitypolicies, wherein the information defining the plurality of firewallsecurity policies includes, for each one of the plurality of firewallsecurity policies, information identifying an associated one of theplurality of configuration schemes and an action to take with respect toa particular network session based on one or more of a set of one ormore source Internet Protocol (IP) addresses, a set of one or moredestination IP addresses and a network service protocol; and performing,by the firewall device, policy-based application-level content filteringof a plurality of network sessions by, for each network session of theplurality of network sessions: identifying, by the kernel, a firewallsecurity policy from among the plurality of firewall security policiesthat matches traffic associated with the network session; when theaction to take of the matching firewall security policy indicates thenetwork session is allowable, then: redirecting, by the kernel, thenetwork session to a proxy of a plurality of proxies running within thefirewall device; identifying, by the proxy, a plurality ofapplication-level content filtering processes to be performed on thetraffic as specified by the configuration scheme specified by thematching firewall security policy; and applying, by the proxy, theidentified plurality of application-level content filtering processes tothe traffic.
 10. The computer-readable storage medium of claim 9,wherein the method further comprises: processing application-levelcontent of a packet stream associated with the network session byreassembling the application-level content from a plurality of packetsof the packet stream; and scanning the application-level content basedon the identified plurality of content filtering processes.
 11. Thecomputer-readable storage medium of claim 10, wherein the networkservice protocol comprises at least one of a group consisting ofHyperText Transfer Protocol (HTTP), File Transfer Protocol (FTP), SimpleMail Transfer Protocol (SMTP), Post Office Protocol 3 (POP3), InternetMessage Access Protocol (IMAP) and Server Message Block/Common InternetFile System (SMB/CIFS).
 12. The computer-readable storage medium ofclaim 11, wherein the method further comprises receiving from a networkadministrator via a graphical user interface selections indicative ofthe content filtering processes to be performed on the trafficassociated with the particular network session.
 13. Thecomputer-readable storage medium of claim 12, wherein content filteringoptions available to the network administrator via the graphical userinterface include at least antivirus scanning, Uniform Resource Locator(URL) blocking and file blocking.
 14. The computer-readable storagemedium of claim 13, wherein the content filtering options available tothe network administrator via the graphical user interface furtherinclude one or more of banned word filtering and spam blocking.
 15. Thecomputer-readable storage medium of claim 14, wherein the file blockingcomprises blocking transmission of specific file types.
 16. Thecomputer-readable storage medium of claim 9, wherein the method furthercomprises receiving from a network administrator, by the firewalldevice, via a graphical user interface, selections indicative of one ofthe plurality of configuration schemes to be associated with one of theplurality of firewall security policies.